@wibeco/bridge 0.1.1 → 0.2.0

package/dist/chunk-FLTLCZ6E.js

@@ -0,0 +1,1074 @@
+// src/events.ts
+import { randomUUID } from "crypto";
+import { z } from "zod";
+var agentSourceSchema = z.enum(["cursor", "claude-code", "codex"]);
+var hookEventKindSchema = z.enum([
+  "presence.heartbeat",
+  "session.started",
+  "session.ended",
+  "lifecycle.before",
+  "lifecycle.after",
+  "tool.started",
+  "tool.completed",
+  "file.changed",
+  "shell.started",
+  "shell.completed",
+  "mcp.started",
+  "mcp.completed",
+  "unknown"
+]);
+var safeScalarSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+var safeValueSchema = z.lazy(
+  () => z.union([safeScalarSchema, z.array(safeValueSchema), z.record(z.string(), safeValueSchema)])
+);
+var canonicalHookEventSchema = z.object({
+  id: z.string().min(1),
+  version: z.literal(1),
+  source: agentSourceSchema,
+  kind: hookEventKindSchema,
+  occurredAt: z.string().datetime(),
+  sessionId: z.string().min(1).optional(),
+  repo: z.object({
+    root: z.string().min(1),
+    remote: z.string().min(1).optional(),
+    branch: z.string().min(1).optional(),
+    commit: z.string().min(1).optional()
+  }).optional(),
+  outcome: z.enum(["success", "failure", "cancelled", "unknown"]).optional(),
+  durationMs: z.number().nonnegative().optional(),
+  metadata: z.record(z.string(), safeValueSchema).default({})
+});
+function createHookEvent(input) {
+  return canonicalHookEventSchema.parse({
+    ...input,
+    id: input.id ?? randomUUID(),
+    version: 1,
+    occurredAt: input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/redaction.ts
+var SENSITIVE_KEY = /authorization|cookie|token|secret|password|passwd|api.?key|prompt|content|input|output|message|transcript/i;
+var SECRET_VALUE = /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[oprsu]_[A-Za-z0-9_]{20,}|(?:bearer|basic)\s+[A-Za-z0-9._~+/-]+=*)\b/gi;
+var PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+function redact(value, options = {}) {
+  const replacement = options.replacement ?? "[REDACTED]";
+  const visit = (current, key) => {
+    if (key && SENSITIVE_KEY.test(key) && !options.allowContent) {
+      return replacement;
+    }
+    if (current === null || typeof current === "boolean" || typeof current === "number") {
+      return current;
+    }
+    if (typeof current === "string") {
+      let result = current.replace(PRIVATE_KEY, replacement).replace(SECRET_VALUE, replacement);
+      if (options.homeDirectory) {
+        result = result.replaceAll(options.homeDirectory, "~");
+      }
+      return result;
+    }
+    if (Array.isArray(current)) {
+      return current.map((item) => visit(item));
+    }
+    if (typeof current === "object") {
+      return Object.fromEntries(
+        Object.entries(current).map(([childKey, child]) => [
+          childKey,
+          visit(child, childKey)
+        ])
+      );
+    }
+    return String(current);
+  };
+  return visit(value);
+}
+function safeMetadata(input, allowedKeys) {
+  const selected = Object.fromEntries(
+    allowedKeys.filter((key) => isSafeMetadataScalar(input[key])).map((key) => [key, input[key]])
+  );
+  return redact(selected);
+}
+function isSafeMetadataScalar(value) {
+  return value === null || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) || typeof value === "string" && value.length <= 512;
+}
+
+// src/adapters/shared.ts
+import { relative, resolve, sep } from "path";
+var OUTCOME_KEYS = ["outcome", "status", "result"];
+function mapHookPayload(source, rawEventName, payload, eventMap, metadataKeys) {
+  const outcomeValue = OUTCOME_KEYS.map((key) => payload[key]).find(
+    (value) => typeof value === "string"
+  );
+  const normalizedOutcome = outcomeValue === "success" || outcomeValue === "failure" || outcomeValue === "cancelled" ? outcomeValue : outcomeValue ? "unknown" : void 0;
+  const duration = payload.duration_ms ?? payload.durationMs;
+  return createHookEvent({
+    source,
+    kind: eventMap[normalizeName(rawEventName)] ?? "unknown",
+    ...typeof payload.session_id === "string" ? { sessionId: payload.session_id } : {},
+    ...normalizedOutcome ? { outcome: normalizedOutcome } : {},
+    ...typeof duration === "number" && duration >= 0 ? { durationMs: duration } : {},
+    metadata: {
+      hookEvent: normalizeName(rawEventName),
+      ...safeMetadata(payload, metadataKeys)
+    }
+  });
+}
+function normalizeName(name) {
+  return name.trim().replaceAll(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replaceAll(/[\s_.]+/g, "-");
+}
+function safeIdentifier(value) {
+  if (typeof value !== "string") return void 0;
+  const normalized = value.trim();
+  return normalized.length > 0 && normalized.length <= 160 && !/[\u0000-\u001f]/.test(normalized) ? normalized : void 0;
+}
+function safeModel(value) {
+  const normalized = safeIdentifier(value);
+  return normalized && /^[A-Za-z0-9][A-Za-z0-9._:/+-]*$/.test(normalized) ? normalized : void 0;
+}
+function safeRelativePath(value, root = process.cwd()) {
+  if (typeof value !== "string" || value.includes("\0")) return void 0;
+  const candidate = value.trim();
+  if (!candidate) return void 0;
+  const resolvedRoot = resolve(root);
+  const resolvedPath = resolve(resolvedRoot, candidate);
+  const path = relative(resolvedRoot, resolvedPath);
+  if (path === ".." || path.startsWith(`..${sep}`)) return void 0;
+  return (path || ".").split(sep).join("/");
+}
+function safeDuration(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+function objectPayload(input) {
+  return input && typeof input === "object" && !Array.isArray(input) ? input : {};
+}
+
+// src/adapters/claude-code.ts
+var events = {
+  "session-start": "session.started",
+  "session-end": "session.ended",
+  heartbeat: "presence.heartbeat",
+  "user-prompt-submit": "lifecycle.before",
+  stop: "lifecycle.after",
+  "pre-tool-use": "tool.started",
+  "post-tool-use": "tool.completed",
+  "post-tool-use-failure": "tool.completed",
+  notification: "lifecycle.after"
+};
+var safeKeys = [
+  "hook_event_name",
+  "tool_name",
+  "permission_mode",
+  "source",
+  "model",
+  "agent_id",
+  "path",
+  "lines_added",
+  "lines_deleted",
+  "session_started_at",
+  "heartbeat_at",
+  "heartbeat_interval_ms",
+  "session_elapsed_ms"
+];
+function mapClaudeCodeHook(eventName, input) {
+  const payload = objectPayload(input);
+  const toolInput = objectPayload(payload.tool_input);
+  const sessionId = safeIdentifier(payload.session_id);
+  const model = safeModel(payload.model);
+  const path = safeRelativePath(
+    toolInput.file_path ?? payload.file_path,
+    typeof payload.cwd === "string" ? payload.cwd : process.cwd()
+  );
+  const duration = safeDuration(payload.duration_ms ?? payload.durationMs);
+  const normalizedEvent = normalizeName(eventName);
+  const toolName = typeof payload.tool_name === "string" ? payload.tool_name.toLowerCase() : "";
+  const event = mapHookPayload(
+    "claude-code",
+    eventName,
+    {
+      ...payload,
+      ...sessionId ? { session_id: sessionId } : {},
+      ...model ? { model } : {},
+      ...path ? { path } : {},
+      ...duration !== void 0 ? { duration_ms: duration } : {},
+      ...normalizedEvent === "post-tool-use-failure" && !payload.outcome ? { outcome: "failure" } : {},
+      ...typeof payload.lines_added === "number" ? { lines_added: payload.lines_added } : {},
+      ...typeof payload.lines_deleted === "number" ? { lines_deleted: payload.lines_deleted } : {}
+    },
+    events,
+    safeKeys
+  );
+  return path && normalizedEvent === "post-tool-use" && (toolName === "write" || toolName === "edit") ? { ...event, kind: "file.changed" } : event;
+}
+
+// src/adapters/codex.ts
+var events2 = {
+  "agent-turn-complete": "lifecycle.after",
+  "session-start": "session.started",
+  "session-end": "session.ended",
+  heartbeat: "presence.heartbeat",
+  "turn-start": "lifecycle.before",
+  "turn-complete": "lifecycle.after",
+  "tool-start": "tool.started",
+  "tool-complete": "tool.completed",
+  "command-start": "shell.started",
+  "command-complete": "shell.completed",
+  "file-change": "file.changed",
+  "user-prompt-submit": "lifecycle.before",
+  "pre-tool-use": "tool.started",
+  "post-tool-use": "tool.completed",
+  "subagent-start": "lifecycle.before",
+  "subagent-stop": "lifecycle.after",
+  stop: "lifecycle.after"
+};
+var safeKeys2 = [
+  "event",
+  "tool_name",
+  "command_type",
+  "model",
+  "reason",
+  "turn_id",
+  "path",
+  "lines_added",
+  "lines_deleted",
+  "session_started_at",
+  "heartbeat_at",
+  "heartbeat_interval_ms",
+  "session_elapsed_ms"
+];
+function mapCodexHook(eventName, input) {
+  const payload = objectPayload(input);
+  const toolInput = objectPayload(payload.tool_input);
+  const threadId = safeIdentifier(
+    payload["thread-id"] ?? payload.thread_id ?? payload.session_id
+  );
+  const turnId = safeIdentifier(payload["turn-id"] ?? payload.turn_id);
+  const model = safeModel(payload.model);
+  const path = safeRelativePath(
+    payload.file_path ?? payload.path ?? toolInput.file_path,
+    typeof payload.cwd === "string" ? payload.cwd : process.cwd()
+  );
+  return mapHookPayload(
+    "codex",
+    eventName,
+    {
+      ...payload,
+      ...threadId ? { session_id: threadId } : {},
+      ...turnId ? { turn_id: turnId } : {},
+      ...model ? { model } : {},
+      ...path ? { path } : {},
+      ...typeof payload.lines_added === "number" ? { lines_added: payload.lines_added } : {},
+      ...typeof payload.lines_deleted === "number" ? { lines_deleted: payload.lines_deleted } : {}
+    },
+    events2,
+    safeKeys2
+  );
+}
+
+// src/adapters/cursor.ts
+var events3 = {
+  "session-start": "session.started",
+  "session-end": "session.ended",
+  heartbeat: "presence.heartbeat",
+  "before-submit-prompt": "lifecycle.before",
+  "after-agent-response": "lifecycle.after",
+  "before-tool": "tool.started",
+  "after-tool": "tool.completed",
+  "after-file-edit": "file.changed",
+  "before-shell-execution": "shell.started",
+  "after-shell-execution": "shell.completed",
+  "before-mcp-execution": "mcp.started",
+  "after-mcp-execution": "mcp.completed"
+};
+var safeKeys3 = [
+  "generation_id",
+  "tool_name",
+  "command_type",
+  "file_extension",
+  "language",
+  "model",
+  "path",
+  "lines_added",
+  "lines_deleted",
+  "session_started_at",
+  "heartbeat_at",
+  "heartbeat_interval_ms",
+  "session_elapsed_ms"
+];
+function mapCursorHook(eventName, input) {
+  const payload = objectPayload(input);
+  const sessionId = safeIdentifier(payload.conversation_id ?? payload.session_id);
+  const model = safeModel(payload.model);
+  const workspaceRoot = Array.isArray(payload.workspace_roots) ? payload.workspace_roots.find(
+    (root) => typeof root === "string"
+  ) : void 0;
+  const path = safeRelativePath(
+    payload.file_path,
+    workspaceRoot ?? process.cwd()
+  );
+  return mapHookPayload(
+    "cursor",
+    eventName,
+    {
+      ...payload,
+      ...sessionId ? { session_id: sessionId } : {},
+      ...model ? { model } : {},
+      ...path ? { path } : {},
+      ...typeof payload.lines_added === "number" ? { lines_added: payload.lines_added } : {},
+      ...typeof payload.lines_deleted === "number" ? { lines_deleted: payload.lines_deleted } : {}
+    },
+    events3,
+    safeKeys3
+  );
+}
+
+// src/client.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function eventTypeForHook(event) {
+  if (event.kind === "session.started") return "presence.started";
+  if (event.kind === "presence.heartbeat") return "presence.heartbeat";
+  if (event.kind === "session.ended") return "presence.stopped";
+  if (event.kind === "file.changed") return "workspace.files_changed";
+  if (event.kind === "shell.completed" && event.outcome && isTestHookEvent(event)) {
+    return "workspace.test_completed";
+  }
+  return null;
+}
+function isTestHookEvent(event) {
+  const labels = [
+    event.metadata.command_type,
+    event.metadata.tool_name,
+    event.metadata.task_type
+  ].filter((value) => typeof value === "string").join(" ").toLowerCase();
+  return /(^|\W)(test|tests|testing|vitest|jest|pytest|playwright)(\W|$)/.test(
+    labels
+  );
+}
+function toEnvelope(event, options) {
+  const type = eventTypeForHook(event);
+  if (!type) {
+    throw new Error(`Hook event ${event.kind} is not publishable`);
+  }
+  const paths = [
+    ...Array.isArray(event.metadata.paths) ? event.metadata.paths.filter((path) => typeof path === "string") : [],
+    ...typeof event.metadata.path === "string" ? [event.metadata.path] : []
+  ];
+  const payload = event.kind === "file.changed" ? {
+    paths,
+    tool: event.source,
+    agent_name: event.source,
+    hook_kind: event.kind,
+    lines_added: typeof event.metadata.lines_added === "number" ? event.metadata.lines_added : void 0,
+    lines_deleted: typeof event.metadata.lines_deleted === "number" ? event.metadata.lines_deleted : void 0
+  } : event.kind === "presence.heartbeat" ? {
+    verification: event.metadata.verification,
+    sequence: event.metadata.sequence,
+    active_seconds: event.metadata.active_seconds,
+    lines_added: event.metadata.lines_added,
+    lines_deleted: event.metadata.lines_deleted,
+    changed_files: event.metadata.changed_files,
+    model: event.metadata.model,
+    model_active_seconds: event.metadata.model_active_seconds,
+    model_seconds: event.metadata.model_seconds,
+    tool_counts: event.metadata.tool_counts,
+    tests_passed: event.metadata.tests_passed,
+    tests_failed: event.metadata.tests_failed,
+    session_started_at: event.metadata.session_started_at,
+    heartbeat_at: event.metadata.heartbeat_at,
+    heartbeat_interval_ms: event.metadata.heartbeat_interval_ms,
+    session_elapsed_ms: event.metadata.session_elapsed_ms,
+    working_tree_lines_added: event.metadata.working_tree_lines_added,
+    working_tree_lines_deleted: event.metadata.working_tree_lines_deleted,
+    tool: event.source,
+    agent_name: event.source,
+    hook_kind: event.kind
+  } : {
+    paths,
+    tool: event.source,
+    agent_name: event.source,
+    outcome: event.outcome,
+    duration_ms: event.durationMs,
+    hook_kind: event.kind,
+    ...event.metadata
+  };
+  return {
+    event_id: event.id,
+    schema_version: 1,
+    occurred_at: event.occurredAt,
+    organization_id: options.organizationId,
+    project_id: options.projectId,
+    repository_id: options.repositoryId,
+    device_id: options.deviceId,
+    source: "local_collector",
+    type,
+    visibility: "project",
+    idempotency_key: `${event.source}:${event.id}`,
+    correlation: {
+      session_id: event.sessionId,
+      branch: event.repo?.branch,
+      commit_sha: event.repo?.commit
+    },
+    payload
+  };
+}
+var SignedBatchClient = class {
+  constructor(options) {
+    this.options = options;
+    this.request = options.fetch ?? globalThis.fetch;
+    this.batchSize = options.batchSize ?? 50;
+    this.timeoutMs = options.timeoutMs ?? 1e4;
+  }
+  options;
+  request;
+  batchSize;
+  timeoutMs;
+  async capture(event) {
+    const parsed = canonicalHookEventSchema.parse(event);
+    if (!eventTypeForHook(parsed)) {
+      return { sent: 0, remaining: await this.options.queue.size() };
+    }
+    await this.options.queue.enqueue([
+      {
+        ...parsed,
+        metadata: redact(parsed.metadata)
+      }
+    ]);
+    return this.flush();
+  }
+  async flush() {
+    const queuedEvents = await this.options.queue.peek(this.batchSize);
+    if (queuedEvents.length === 0) return { sent: 0, remaining: 0 };
+    const events4 = queuedEvents.filter((event) => eventTypeForHook(event));
+    const ignoredIds = queuedEvents.filter((event) => !eventTypeForHook(event)).map((event) => event.id);
+    if (ignoredIds.length > 0) await this.options.queue.remove(ignoredIds);
+    if (events4.length === 0) {
+      return { sent: 0, remaining: await this.options.queue.size() };
+    }
+    const body = JSON.stringify({
+      batch_id: randomUUID2(),
+      events: events4.map((event) => toEnvelope(event, this.options))
+    });
+    try {
+      const response = await this.request(this.options.endpoint, {
+        method: "POST",
+        body,
+        signal: AbortSignal.timeout(this.timeoutMs),
+        headers: {
+          "content-type": "application/json",
+          "user-agent": "wibe-bridge/1",
+          authorization: `Bearer ${this.options.accessToken}`
+        }
+      });
+      if (!response.ok) {
+        const requestId = response.headers.get("x-request-id");
+        let detail = "";
+        try {
+          const body2 = await response.json();
+          const code = typeof body2.code === "string" ? body2.code.slice(0, 80) : void 0;
+          const message = typeof body2.error === "string" ? body2.error.slice(0, 160) : void 0;
+          detail = [code, message].filter(Boolean).join(": ");
+        } catch {
+        }
+        const suffix = [
+          detail ? `: ${detail}` : "",
+          requestId ? ` (request ${requestId.slice(0, 80)})` : ""
+        ].join("");
+        throw new Error(`Collector returned HTTP ${response.status}${suffix}`);
+      }
+      await this.options.queue.remove(events4.map((event) => event.id));
+      return { sent: events4.length, remaining: await this.options.queue.size() };
+    } catch (error) {
+      return {
+        sent: 0,
+        remaining: await this.options.queue.size(),
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+};
+
+// src/queue.ts
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { dirname } from "path";
+var MemoryOfflineQueue = class {
+  events = [];
+  async enqueue(events4) {
+    this.events.push(...events4);
+  }
+  async peek(limit) {
+    return this.events.slice(0, Math.max(0, limit));
+  }
+  async remove(ids) {
+    const removed = new Set(ids);
+    this.events = this.events.filter((event) => !removed.has(event.id));
+  }
+  async size() {
+    return this.events.length;
+  }
+};
+var JsonFileOfflineQueue = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  operation = Promise.resolve();
+  async enqueue(events4) {
+    await this.update((current) => [...current, ...events4]);
+  }
+  async peek(limit) {
+    await this.operation;
+    return (await this.read()).slice(0, Math.max(0, limit));
+  }
+  async remove(ids) {
+    const removed = new Set(ids);
+    await this.update((current) => current.filter((event) => !removed.has(event.id)));
+  }
+  async size() {
+    await this.operation;
+    return (await this.read()).length;
+  }
+  async read() {
+    try {
+      const data = JSON.parse(await readFile(this.filePath, "utf8"));
+      return canonicalHookEventSchema.array().parse(data);
+    } catch (error) {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    }
+  }
+  async update(transform) {
+    const next = this.operation.then(async () => {
+      const events4 = transform(await this.read());
+      await mkdir(dirname(this.filePath), { recursive: true, mode: 448 });
+      const temporary = `${this.filePath}.${process.pid}.tmp`;
+      await writeFile(temporary, JSON.stringify(events4), { encoding: "utf8", mode: 384 });
+      await rename(temporary, this.filePath);
+    });
+    this.operation = next.catch(() => void 0);
+    await next;
+  }
+};
+
+// src/presence.ts
+import { createHash, randomUUID as randomUUID3 } from "crypto";
+import { spawn } from "child_process";
+import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+var PRESENCE_HEARTBEAT_INTERVAL_MS = 45e3;
+var MAX_SESSION_DURATION_MS = 12 * 60 * 60 * 1e3;
+async function startPresenceSession(source, sessionId, cwd = process.cwd()) {
+  const statePath = presenceStatePath(source, sessionId, cwd);
+  await rm(statePath, { force: true });
+  await mkdir2(presenceDirectory(), { recursive: true, mode: 448 });
+  const instanceId = randomUUID3();
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const cliPath = process.argv[1];
+  const state = {
+    instanceId,
+    source,
+    ...sessionId ? { sessionId } : {},
+    startedAt,
+    pid: 0,
+    sequence: 0,
+    linesAdded: 0,
+    linesDeleted: 0,
+    paths: [],
+    modelSeconds: {},
+    toolCounts: {},
+    testsPassed: 0,
+    testsFailed: 0,
+    measuredAt: startedAt
+  };
+  const metrics = metricsFromState(state, startedAt);
+  if (!cliPath) return metrics;
+  const child = spawn(
+    process.execPath,
+    [
+      ...process.execArgv,
+      cliPath,
+      "_presence-heartbeat",
+      "--adapter",
+      source,
+      "--state",
+      statePath,
+      "--instance",
+      instanceId
+    ],
+    {
+      cwd,
+      detached: true,
+      stdio: "ignore",
+      env: process.env
+    }
+  );
+  child.unref();
+  state.pid = child.pid ?? 0;
+  await writePresenceState(statePath, state);
+  return metrics;
+}
+async function updatePresenceSession(source, sessionId, event, cwd = process.cwd()) {
+  const statePath = presenceStatePath(source, sessionId, cwd);
+  const state = await readPresenceState(statePath);
+  if (!state) return void 0;
+  const measuredAt = (/* @__PURE__ */ new Date()).toISOString();
+  accrueModelTime(state, measuredAt);
+  const model = typeof event.metadata.model === "string" ? event.metadata.model : void 0;
+  if (model) state.model = model;
+  state.linesAdded += safeCount(event.metadata.lines_added);
+  state.linesDeleted += safeCount(event.metadata.lines_deleted);
+  const workingLinesAdded = optionalCount(
+    event.metadata.working_tree_lines_added
+  );
+  const workingLinesDeleted = optionalCount(
+    event.metadata.working_tree_lines_deleted
+  );
+  if (workingLinesAdded !== void 0) {
+    state.baselineLinesAdded ??= workingLinesAdded;
+    state.linesAdded = Math.max(
+      state.linesAdded,
+      workingLinesAdded - state.baselineLinesAdded
+    );
+  }
+  if (workingLinesDeleted !== void 0) {
+    state.baselineLinesDeleted ??= workingLinesDeleted;
+    state.linesDeleted = Math.max(
+      state.linesDeleted,
+      workingLinesDeleted - state.baselineLinesDeleted
+    );
+  }
+  const paths = [
+    ...Array.isArray(event.metadata.paths) ? event.metadata.paths.filter(
+      (path) => typeof path === "string"
+    ) : [],
+    ...Array.isArray(event.metadata.working_tree_paths) ? event.metadata.working_tree_paths.filter(
+      (path) => typeof path === "string"
+    ) : [],
+    ...typeof event.metadata.path === "string" ? [event.metadata.path] : []
+  ];
+  state.paths = [.../* @__PURE__ */ new Set([...state.paths, ...paths])].slice(0, 2e3);
+  const category = toolCategory(event);
+  if (category) {
+    state.toolCounts[category] = (state.toolCounts[category] ?? 0) + 1;
+  }
+  if (event.kind === "shell.completed" && isTestEvent(event)) {
+    if (event.outcome === "success") state.testsPassed += 1;
+    if (event.outcome === "failure") state.testsFailed += 1;
+  }
+  await writePresenceState(statePath, state);
+  return metricsFromState(state, measuredAt);
+}
+async function stopPresenceSession(source, sessionId, cwd = process.cwd()) {
+  const statePath = presenceStatePath(source, sessionId, cwd);
+  const state = await readPresenceState(statePath);
+  await rm(statePath, { force: true });
+  if (!state) return void 0;
+  const measuredAt = (/* @__PURE__ */ new Date()).toISOString();
+  accrueModelTime(state, measuredAt);
+  state.sequence += 1;
+  return metricsFromState(state, measuredAt);
+}
+async function runPresenceHeartbeat(statePath, expectedInstanceId, emit, intervalMs = PRESENCE_HEARTBEAT_INTERVAL_MS) {
+  let nextHeartbeat = Date.now() + intervalMs;
+  for (; ; ) {
+    await delay(Math.min(1e3, Math.max(0, nextHeartbeat - Date.now())));
+    const state = await readPresenceState(statePath);
+    if (!state || state.instanceId !== expectedInstanceId) return;
+    if (Date.now() < nextHeartbeat) continue;
+    const heartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (Date.parse(heartbeatAt) - Date.parse(state.startedAt) > MAX_SESSION_DURATION_MS) {
+      await rm(statePath, { force: true });
+      return;
+    }
+    accrueModelTime(state, heartbeatAt);
+    state.sequence += 1;
+    await writePresenceState(statePath, state);
+    await emit(state.source, "heartbeat", {
+      ...state.sessionId ? { session_id: state.sessionId } : {},
+      heartbeat_at: heartbeatAt,
+      heartbeat_interval_ms: intervalMs,
+      ...metricsFromState(state, heartbeatAt)
+    });
+    nextHeartbeat += intervalMs;
+    if (nextHeartbeat <= Date.now()) nextHeartbeat = Date.now() + intervalMs;
+  }
+}
+function presenceStatePath(source, sessionId, cwd = process.cwd()) {
+  const key = createHash("sha256").update(`${source}\0${sessionId ?? ""}\0${cwd}`).digest("hex");
+  return join(presenceDirectory(), `${key}.json`);
+}
+function presenceDirectory() {
+  return process.env.WIBE_PRESENCE_DIR ?? join(homedir(), ".wibe", "presence");
+}
+async function readPresenceState(path) {
+  try {
+    const value = JSON.parse(await readFile2(path, "utf8"));
+    if (typeof value.instanceId !== "string" || value.source !== "cursor" && value.source !== "claude-code" && value.source !== "codex" || typeof value.startedAt !== "string" || !Number.isFinite(Date.parse(value.startedAt)) || typeof value.pid !== "number") {
+      return void 0;
+    }
+    return {
+      instanceId: value.instanceId,
+      source: value.source,
+      sessionId: typeof value.sessionId === "string" ? value.sessionId : void 0,
+      startedAt: value.startedAt,
+      pid: value.pid,
+      sequence: safeCount(value.sequence),
+      linesAdded: safeCount(value.linesAdded),
+      linesDeleted: safeCount(value.linesDeleted),
+      baselineLinesAdded: optionalCount(value.baselineLinesAdded),
+      baselineLinesDeleted: optionalCount(value.baselineLinesDeleted),
+      paths: Array.isArray(value.paths) ? value.paths.filter((path2) => typeof path2 === "string") : [],
+      model: typeof value.model === "string" ? value.model : void 0,
+      modelSeconds: safeCountRecord(value.modelSeconds),
+      toolCounts: safeCountRecord(value.toolCounts),
+      testsPassed: safeCount(value.testsPassed),
+      testsFailed: safeCount(value.testsFailed),
+      measuredAt: typeof value.measuredAt === "string" && Number.isFinite(Date.parse(value.measuredAt)) ? value.measuredAt : value.startedAt
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function writePresenceState(path, state) {
+  await writeFile2(path, `${JSON.stringify(state)}
+`, { mode: 384 });
+}
+function accrueModelTime(state, measuredAt) {
+  const elapsedSeconds = Math.max(
+    0,
+    Math.floor(
+      (Date.parse(measuredAt) - Date.parse(state.measuredAt || state.startedAt)) / 1e3
+    )
+  );
+  if (state.model && elapsedSeconds > 0) {
+    state.modelSeconds[state.model] = (state.modelSeconds[state.model] ?? 0) + elapsedSeconds;
+  }
+  state.measuredAt = measuredAt;
+}
+function metricsFromState(state, measuredAt) {
+  const sessionElapsedMs = Math.max(
+    0,
+    Date.parse(measuredAt) - Date.parse(state.startedAt)
+  );
+  return {
+    session_started_at: state.startedAt,
+    session_elapsed_ms: sessionElapsedMs,
+    sequence: state.sequence,
+    active_seconds: Math.floor(sessionElapsedMs / 1e3),
+    lines_added: state.linesAdded,
+    lines_deleted: state.linesDeleted,
+    changed_files: state.paths.length,
+    model_seconds: state.modelSeconds,
+    tool_counts: state.toolCounts,
+    tests_passed: state.testsPassed,
+    tests_failed: state.testsFailed
+  };
+}
+function safeCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : 0;
+}
+function optionalCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
+}
+function safeCountRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry) => typeof entry[1] === "number" && Number.isFinite(entry[1]) && entry[1] >= 0
+    ).map(([key, count]) => [key.slice(0, 160), Math.floor(count)])
+  );
+}
+function toolCategory(event) {
+  if (event.kind === "file.changed") return "edit";
+  if (event.kind === "shell.started" || event.kind === "shell.completed") {
+    return "shell";
+  }
+  if (event.kind === "mcp.started" || event.kind === "mcp.completed") {
+    return "mcp";
+  }
+  if (event.kind === "tool.started" || event.kind === "tool.completed") {
+    return "tool";
+  }
+  return void 0;
+}
+function isTestEvent(event) {
+  const labels = [
+    event.metadata.command_type,
+    event.metadata.tool_name,
+    event.metadata.task_type
+  ].filter((value) => typeof value === "string").join(" ").toLowerCase();
+  return /(^|\W)(test|tests|testing|vitest|jest|pytest|playwright)(\W|$)/.test(
+    labels
+  );
+}
+function delay(milliseconds) {
+  return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
+}
+
+// src/repo.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+async function git(cwd, args) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      encoding: "utf8",
+      timeout: 2e3,
+      maxBuffer: 64 * 1024
+    });
+    return stdout.trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function detectRepository(cwd = process.cwd()) {
+  const root = await git(cwd, ["rev-parse", "--show-toplevel"]);
+  if (!root) return void 0;
+  const [remote, branch, commit] = await Promise.all([
+    git(root, ["remote", "get-url", "origin"]),
+    git(root, ["branch", "--show-current"]),
+    git(root, ["rev-parse", "HEAD"])
+  ]);
+  return {
+    root,
+    ...remote ? { remote: sanitizeRemote(remote) } : {},
+    ...branch ? { branch } : {},
+    ...commit ? { commit } : {}
+  };
+}
+async function detectWorkingTreeMetrics(root) {
+  const output = await git(root, ["diff", "--numstat", "HEAD", "--"]);
+  if (output === void 0) return void 0;
+  let linesAdded = 0;
+  let linesDeleted = 0;
+  const paths = [];
+  for (const line of output.split("\n")) {
+    if (!line) continue;
+    const [added, deleted, ...pathParts] = line.split("	");
+    const path = pathParts.join("	");
+    if (!path || isSensitivePath(path)) continue;
+    if (/^\d+$/.test(added)) linesAdded += Number(added);
+    if (/^\d+$/.test(deleted)) linesDeleted += Number(deleted);
+    paths.push(path);
+  }
+  return { linesAdded, linesDeleted, paths: [...new Set(paths)].slice(0, 2e3) };
+}
+function sanitizeRemote(remote) {
+  try {
+    const url = new URL(remote);
+    url.username = "";
+    url.password = "";
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return remote.replace(
+      /^(?:[^@\s]+@)?([^:\s]+):(.+)$/,
+      (_match, host, path) => `${host}:${path}`
+    );
+  }
+}
+function normalizeGitHubRepository(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return void 0;
+  let path = trimmed;
+  try {
+    const url = new URL(trimmed);
+    if (url.hostname.toLowerCase() !== "github.com") return void 0;
+    path = url.pathname;
+  } catch {
+    const scpLike = trimmed.match(
+      /^(?:(?:[^@\s]+)@)?github\.com:(.+)$/i
+    );
+    if (scpLike) {
+      path = scpLike[1];
+    } else if (/^github\.com\//i.test(trimmed)) {
+      path = trimmed.replace(/^github\.com\//i, "");
+    } else if (/^[^/\s]+\/[^/\s]+\/?$/.test(trimmed)) {
+      path = trimmed;
+    } else {
+      return void 0;
+    }
+  }
+  const normalized = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").toLowerCase();
+  return /^[^/\s]+\/[^/\s]+$/.test(normalized) ? normalized : void 0;
+}
+function matchesGitHubRepository(remote, expected) {
+  const normalizedRemote = remote ? normalizeGitHubRepository(remote) : void 0;
+  const normalizedExpected = normalizeGitHubRepository(expected);
+  return Boolean(
+    normalizedRemote && normalizedExpected && normalizedRemote === normalizedExpected
+  );
+}
+function isSensitivePath(path) {
+  return /(^|\/)\.env(?:\.|$)/i.test(path) || /(^|\/)(?:id_rsa|id_ed25519|credentials|secrets?)(?:\.|$)/i.test(path) || /\.(?:pem|key|p12|pfx)$/i.test(path);
+}
+
+// src/auth.ts
+import { z as z2 } from "zod";
+import { execFile as execFileCallback } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCallback);
+var deviceAuthorizationSchema = z2.object({
+  device_code: z2.string().min(1),
+  user_code: z2.string().min(1),
+  verification_uri: z2.string().url(),
+  verification_uri_complete: z2.string().url().optional(),
+  expires_at: z2.string().datetime(),
+  interval: z2.number().int().positive().default(5)
+});
+var deviceTokenResponseSchema = z2.discriminatedUnion("status", [
+  z2.object({
+    status: z2.literal("approved"),
+    accessToken: z2.string().min(1),
+    projectId: z2.string().uuid(),
+    organizationId: z2.string().uuid(),
+    repositoryId: z2.string().uuid().optional(),
+    deviceId: z2.string().uuid()
+  }),
+  z2.object({
+    status: z2.enum(["pending", "denied"])
+  }),
+  z2.object({
+    status: z2.enum(["expired", "invalid"])
+  })
+]);
+var SystemCredentialStore = class {
+  async get(service, account) {
+    try {
+      if (process.platform === "darwin") {
+        const { stdout } = await execFile2("security", [
+          "find-generic-password",
+          "-s",
+          service,
+          "-a",
+          account,
+          "-w"
+        ]);
+        return stdout.trim() || void 0;
+      }
+      if (process.platform === "linux") {
+        const { stdout } = await execFile2("secret-tool", [
+          "lookup",
+          "service",
+          service,
+          "account",
+          account
+        ]);
+        return stdout.trim() || void 0;
+      }
+      throw new Error("Use WIBE_ACCESS_TOKEN on platforms without a supported keychain.");
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("Use WIBE_")) throw error;
+      return void 0;
+    }
+  }
+  async set(service, account, value) {
+    if (process.platform === "darwin") {
+      await execFile2("security", [
+        "add-generic-password",
+        "-U",
+        "-s",
+        service,
+        "-a",
+        account,
+        "-w",
+        value
+      ]);
+      return;
+    }
+    if (process.platform === "linux") {
+      await new Promise((resolve2, reject) => {
+        const child = execFileCallback(
+          "secret-tool",
+          ["store", "--label=Wibe agent bridge", "service", service, "account", account],
+          (error) => error ? reject(error) : resolve2()
+        );
+        child.stdin?.end(value);
+      });
+      return;
+    }
+    throw new Error("No supported OS keychain was found.");
+  }
+  async delete(service, account) {
+    if (process.platform === "darwin") {
+      await execFile2("security", [
+        "delete-generic-password",
+        "-s",
+        service,
+        "-a",
+        account
+      ]).catch(() => void 0);
+      return;
+    }
+    if (process.platform === "linux") {
+      await execFile2("secret-tool", [
+        "clear",
+        "service",
+        service,
+        "account",
+        account
+      ]).catch(() => void 0);
+      return;
+    }
+  }
+};
+async function requestDeviceAuthorization(input) {
+  const response = await fetch(
+    `${input.appUrl.replace(/\/$/, "")}/api/devices/authorize`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        projectId: input.projectId,
+        deviceName: input.deviceName,
+        agentName: input.agentName
+      })
+    }
+  );
+  if (!response.ok) throw new Error(`Device authorization failed (${response.status}).`);
+  return deviceAuthorizationSchema.parse(await response.json());
+}
+async function pollDeviceToken(input) {
+  const response = await fetch(
+    `${input.appUrl.replace(/\/$/, "")}/api/devices/authorize`,
+    {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_code: input.deviceCode })
+    }
+  );
+  if (!response.ok) throw new Error(`Device polling failed (${response.status}).`);
+  return deviceTokenResponseSchema.parse(await response.json());
+}
+
+export {
+  agentSourceSchema,
+  hookEventKindSchema,
+  safeValueSchema,
+  canonicalHookEventSchema,
+  createHookEvent,
+  redact,
+  safeMetadata,
+  mapClaudeCodeHook,
+  mapCodexHook,
+  mapCursorHook,
+  eventTypeForHook,
+  SignedBatchClient,
+  MemoryOfflineQueue,
+  JsonFileOfflineQueue,
+  PRESENCE_HEARTBEAT_INTERVAL_MS,
+  startPresenceSession,
+  updatePresenceSession,
+  stopPresenceSession,
+  runPresenceHeartbeat,
+  presenceStatePath,
+  detectRepository,
+  detectWorkingTreeMetrics,
+  sanitizeRemote,
+  normalizeGitHubRepository,
+  matchesGitHubRepository,
+  deviceAuthorizationSchema,
+  deviceTokenResponseSchema,
+  SystemCredentialStore,
+  requestDeviceAuthorization,
+  pollDeviceToken
+};